Read this before a vendor says “Part 11 certified”
21 CFR Part 11 is the FDA’s regulation on electronic records and electronic signatures. It is not a software seal. A LIMS can be designed to support Part 11 controls; a laboratory still validates the system for intended use, writes SOPs, and trains people.
If a datasheet says the product is “Part 11 certified” or “FDA approved,” treat that as a language problem. Ask what was actually built — and what remains on you.
1. Electronic records you can reconstruct
Part 11 is not only about storing files. It is about whether records remain complete, attributable, and retrievable for as long as you need them. In a LIMS, that usually means samples, results, methods, specifications, reviews, and quality events.
- Can you retrieve the record by sample, batch, method, user, and date range?
- Are corrections new events rather than silent overwrites?
- Are regulated records protected from casual hard delete?
- Can QA export a coherent package for an inspector?
2. Audit trails that a human can use
An audit trail that only a database administrator can query is not an inspection tool. You want user, timestamp, action, and enough before/after context to explain the change — in the application, with filters QA understands.
Ask whether audit records themselves can be edited. The answer should be no: append-only, with additional records if a correction is required.
3. E-signatures with meaning
A login is not a signature. Part 11 signatures need identity, date/time, and meaning (for example, reviewed or approved). The signature should be bound to the record it applies to so the PDF and the database cannot quietly diverge.
Ask how signature meaning is configured, whether re-authentication is required, and how a signature appears on CoA or release documentation.
4. Access, authority, and training
Authority to perform a regulated action should come from roles — and, in many labs, from current training. Shared passwords and generic “admin” accounts fail this conversation immediately.
- Role-based access control with least privilege
- Unique user identity
- Optional training gates before method execution or approval
- Joiner/mover/leaver process that IT and QA both accept
5. Operational system controls
Part 11 also expects operational controls: validated workflows, device checks where relevant, and the ability to generate accurate copies. This is where IT and QA must sit in the same meeting. Deployment model (cloud, on-prem, hybrid), backup, and time synchronization are in scope even if they are not “features” on the homepage.
6. Validation responsibility — write this down
Vendors may provide IQ/OQ documentation packages and support materials. They do not take ownership of your validated state. Your protocol, your traceability, your approval.
Aureon LIMS is designed to support 21 CFR Part 11 workflows with immutable audit history, e-signatures, and lifecycle statuses instead of hard deletes of regulated data. We state that plainly so buyers can put the right items on their validation plan.
A one-page demo script
In the demo, create a sample, enter a result, fail a specification, open an investigation, correct a value, sign a review, and export the history. If any step requires a side tool or a verbal “we would handle that in validation,” note it. The checklist is not a slogan. It is that walk-through.
